From cc01910eb1b1795b1dac99a65d044e5fa017712b Mon Sep 17 00:00:00 2001 From: Damien Date: Fri, 26 Jun 2026 11:17:36 +0200 Subject: [PATCH] fix(postfix-pgsql): disable chroot to fix pgsql lookup DNS resolution --- images/postfix-pgsql/README.md | 7 +++++++ images/postfix-pgsql/docker-entrypoint.sh | 6 ++++++ 2 files changed, 13 insertions(+) diff --git a/images/postfix-pgsql/README.md b/images/postfix-pgsql/README.md index 11b0057..c50b311 100644 --- a/images/postfix-pgsql/README.md +++ b/images/postfix-pgsql/README.md @@ -27,6 +27,13 @@ On startup, the entrypoint renders three files from templates under - `/etc/postfix/pgsql-transport-maps.cf` — PostgreSQL lookup that tells Postfix where to forward accepted mail (the internal SMTP relay target). +Chroot is disabled for all Postfix services via `postconf -F '*/*/chroot = n'` +on every startup. Postfix's chrooted child processes (smtpd, trivial-rewrite, +etc.) lack access to `/etc/resolv.conf` inside the chroot jail, so they cannot +resolve Docker-internal hostnames — causing every PostgreSQL lookup to fail with +`451 4.3.0 Temporary lookup failure`. Disabling chroot is the standard remedy +in containerised deployments. + ## Environment variables ### Required diff --git a/images/postfix-pgsql/docker-entrypoint.sh b/images/postfix-pgsql/docker-entrypoint.sh index 9ab2416..883c97c 100644 --- a/images/postfix-pgsql/docker-entrypoint.sh +++ b/images/postfix-pgsql/docker-entrypoint.sh @@ -59,4 +59,10 @@ chmod 640 /etc/postfix/pgsql-relay-domains.cf /etc/postfix/pgsql-transport-maps. postfix check +# Disable chroot for all master.cf services so child processes (smtpd, +# trivial-rewrite, etc.) can resolve Docker-internal hostnames via the host's +# /etc/resolv.conf. Without this, chrooted processes have no DNS and every +# pgsql lookup returns "451 4.3.0 Temporary lookup failure". +postconf -F '*/*/chroot = n' + exec /usr/sbin/postfix start-fg